HARCHAtelier
Skip to main content
HARCHAtelier
Sign inPricing
Request a demo
ENGINEERING TRANSPARENCY— stress-case catalog, not a lock

The Resilience Matrix.
100 ways the system must not fail.

A media-monitoring platform for the Moroccan market faces a specific spectrum of failure modes: Darija sarcasm, code-switching, AFP dispatch deduplication, OFAC homonyms, Cloudflare challenges on Hespress, weekend bad-buzz velocity, deleted articles that must stay legally archived. This page catalogs the 100 cases that matter and shows — live, in your browser — how the engine handles each one.

Try the live demos ↓Browse all 100 cases
△
HONEST FRAMING

You may have seen this catalog framed as a “lock” that traps the agent until 100/100 tests pass. That framing is not real — there is no enforcer and no sessionCanEnd variable. We treat it for what it is: a serious robustness reference. The coverage bar below is honest. 17 cases are interactive here; the rest are architecturally handled, planned, or on the roadmap.

Interactive live demos

Each demo runs the real engine — no mocks. Edit the input, click run, see the verdict and the internal signals the engine used.

#021#022#023#026#027

Darija + Multilingual Sentiment Engine

Lexicon-based sentiment with sarcasm-flip detection, FR/AR code-switching, contextual idiom handling, SMS-typo expansion, and clause-level recency weighting.

Click “Analyze sentiment” to run the engine.
#029

Prompt-Injection Sanitizer

Pattern-based detection of “ignore previous”, role-hijack, tag-injection, and prompt-extraction attempts. Malicious input is blocked before reaching the LLM — the model only sees a safe literal.

Click “Scan input” to evaluate.
#030

Fake-News Structural Score

Virality/fakeness risk from structural signals: caps-lock ratio, aggressive-emoji density, exclamation density, sensational vocabulary, ALL-CAPS words. Not a content judgement — a structural risk score.

Click “Score fakeness” to evaluate.
#044

Fuzzy Name Matching (Jaro-Winkler)

Transliteration-aware Jaro-Winkler matching — normalises Mohammed/Mohamed, Al/El, hyphens/spaces, then computes similarity. Used for OFAC screening and entity deduplication.

Click “Match names” to compute similarity.
#043

OFAC False-Positive Disambiguation

Name match alone is not a sanctions hit. Corroborate with DOB, nationality, and occupation. A homonym (same name, different person) is flagged as FALSE POSITIVE, not escalated.

Click “Screen against watchlist” to run.
#097

CEO Homonym Resolution by Tenure

When a current and former CEO share a surname, resolve which one an article refers to using the article's publication date against the tenure window.

Try 2026-06-15 (current CEO) or 2005-03-10 (former CEO).
#013

AFP Dispatch Deduplication

64-bit content simhash with Hamming-distance threshold (≤4 bits ≈ near-identical). When 5 media publish the same AFP dispatch at the comma, only the first is ingested — the rest are linked as duplicates.

The fixture has 2 canonical dispatches pre-loaded. Try a near-copy.
#098

Deleted-Article Legal Archive

When an article is published then removed 5 minutes later, HarchAtelier never deletes it. The immutable content snapshot is retained with a “Retiré” tag, linked into a hash-chained ledger — mathematically tamper-evident.

Ingest an article, then mark it Retiré — note it is never deleted.
#099

Astroturfing / Coordinated-Campaign Detection

12 fresh accounts (<30 days old), all posting near-identical negative reviews within minutes. The engine combines account-age, burst velocity, near-duplicate content, and low-credibility signals into a single coordination risk score.

Click to load a coordinated-campaign fixture and score it.
#006

Recursive Query-Depth Guard

A malicious client sends an infinitely-nested GraphQL-style query to exhaust server resources. The depth guard counts brace nesting and rejects anything beyond the limit (default 10) before parsing.

Click to measure nesting depth.
#009

Sliding-Window Rate Limiter

Brute-force login attempts are capped at 5 per 60s per identity. The 6th onward receive HTTP 429 with a Retry-After header. The limiter uses a sliding window (not fixed), so bursts right after the window rolls over are still bounded.

× 1s apart
Simulates N login attempts at 1s intervals.
#042

Alert-Storm Collapse

1000 negative mentions arrive in 5 minutes for the same entity. Instead of 1000 notifications, the velocity-based collapser emits ONE macro alert with a representative headline, the peak severity, and the source list.

in 5 min window
Simulates N negative mentions against one entity.
#048

Escalation Timer (L1 → L2 → Comex)

An unacknowledged critical alert escalates: after 30 min it pings management (L2), after 60 min the Comex (L3). Acknowledging within SLA freezes the escalation.

min
Try 15min (L1), 45min (L2), 75min (L3).

The full 100-case catalog

Every case HarchAtelier must handle without crashing, leaking data, or hallucinating. Honest status — no fake 100%. 17 cases are interactive above; the rest are architecturally covered, planned, or on the roadmap.

Coverage of 100 cases45% shipped · 55% pending
Live demo(17)
Architectural(28)
Planned(32)
Roadmap(23)

Block 1 — Multi-tenant & Security

#001ARCHITECTURAL
Corrupted tenant_id header
Reject malformed tenant_id values at the API boundary before they reach business logic.
#002PLANNED
Race condition on workspace delete
Two admins delete the same workspace at the same millisecond — optimistic-concurrency guard via version token.
#003ARCHITECTURAL
IDOR — cross-tenant report access
Banque A tries to read Banque B's PR report via URL manipulation — ownership check on every read.
#004PLANNED
JWT expires mid-export
A 500-page PDF export outlives the user's token — refresh-token continuation or signed export job token.
#005ARCHITECTURAL
RBAC privilege escalation
Viewer → Org Admin via JSON manipulation — server-side role re-validation on every mutation.
#006LIVE DEMO
Recursive query depth DoS
Infinitely-nested GraphQL-style query crashes the server — depth guard.
#007PLANNED
Revoke access mid-WebSocket
Employee fired while a WS session is open — session re-validate on every message.
#008ARCHITECTURAL
API key leak in logs
Logger auto-masks secrets (Bearer tokens, API keys, PII).
#009LIVE DEMO
Brute-force on login
Strict rate limit + exponential backoff + lockout.
#010ARCHITECTURAL
Tamper-evident audit log
Hash-chained append-only audit log — mathematically inalterable.

Block 2 — Ingestion & Pipeline

#011ARCHITECTURAL
Non-UTF8 RSS encoding
Iconv auto-detection + fallback chain (ISO-8859-1, Windows-1256 for Arabic).
#012ROADMAP
50k articles in 10s
Backpressure-aware buffer — never drop, spill to disk queue if over capacity.
#013LIVE DEMO
AFP dispatch dedup across 5 media
64-bit content simhash + Hamming threshold collapses near-identical articles.
#014ARCHITECTURAL
50MB text payload OOM
Hard 2MB body limit + streaming parse, reject oversized payloads at the edge.
#015ROADMAP
Postgres mid-write failure
Dead-letter queue + at-least-once delivery with idempotency keys.
#016ROADMAP
Elasticsearch mapping conflict
Explicit index templates reject dynamic-type changes.
#017PLANNED
Network interruption mid-scrape
Resumable scrapers with content-range checkpoints.
#018ROADMAP
Cloudflare JS Challenge on Hespress
Headless-browser fallback + polite crawl delay.
#019ROADMAP
Reddit honeypot IP ban
Rotating residential egress + behaviour-based trap detection.
#020ROADMAP
OCR on scanned PDF tables
Tesseract + table-structure reconstruction.

Block 3 — NLP, Darija & Sentiment

#021LIVE DEMO
Darija sarcasm — "Tbarkellah 3la service, mchaw lflous"
Positive-marker + negative-reality pattern detection → flips overall polarity to NEGATIVE.
#022LIVE DEMO
FR/AR code-switching — "khayb bzaf, 0/10"
Unified FR + Darija lexicon with mixed-script scoring.
#023LIVE DEMO
False positive — "C'est de la bombe"
Contextual idiom detection flips "bombe" from violence-neg to slang-pos.
#024PLANNED
Homonym entity — Orange (telco) vs Orange (fruit)
Context-window disambiguation with sector vocabulary.
#025ROADMAP
Double negation
Dependency-aware negation parser handles "Ce n'est pas que le produit n'est pas mauvais".
#026LIVE DEMO
SMS typos — "Bnk" → "Banque"
Abbreviation expansion dictionary applied before sentiment scoring.
#027LIVE DEMO
Mid-text sentiment flip
Clause-level scoring with recency weighting — "commence bien, finit mal" → final NEGATIVE.
#028PLANNED
LLM 15s timeout
Streaming + 8s soft deadline with cached fallback response.
#029LIVE DEMO
Prompt injection via Facebook comment
Pattern-based sanitizer blocks "ignore previous instructions" and role-hijack.
#030LIVE DEMO
Fake-news structure (caps lock + emoji)
Structural virality score: caps ratio, aggressive emoji density, sensational vocab.

Block 4 — WhatsApp Inbound

#031PLANNED
5-min voice message instead of text
ASR transcription (z-ai-web-dev-sdk) → sentiment on transcript.
#032PLANNED
Photo of a paper article
VLM OCR + structure extraction.
#033ARCHITECTURAL
Spam — 50 msgs in 10s
Per-conversation rate limit, bot replies once.
#034PLANNED
Twilio webhook timeout
Async ack + Twilio StatusCallback pattern.
#035PLANNED
Broken/paywalled link
HEAD probe + paywall detector + graceful fallback message.
#036ARCHITECTURAL
Unknown WhatsApp number
Onboarding flow + demo-mode for unrecognised senders.
#037PLANNED
Persistent context — "Et la BMCE ?"
Conversation state with entity reference carry-over.
#038ROADMAP
Twilio policy block
Pre-send policy classifier + template fallback.
#039ARCHITECTURAL
vCard / contact inbound
Parse + acknowledge, no LLM call.
#040ARCHITECTURAL
RGPD unsubscribe via "Stop"
Honour Stop/Unsubscribe keywords immediately, log consent withdrawal.

Block 5 — Risk Radar & Alerting

#041PLANNED
Critical alert bypasses DND
Severity-gated routing — Critical severity bypasses user DND.
#042LIVE DEMO
Storm — 1000 mentions → 1 macro alert
Velocity-based collapse into a single notification with representative headline.
#043LIVE DEMO
OFAC false-positive homonym
Name match + DOB/nationality/occupation corroboration → distinguish homonym from sanctioned individual.
#044LIVE DEMO
Fuzzy match — Mohammed Al-Fayed vs Mohamed El Fayed
Jaro-Winkler on transliteration-normalized names.
#045ARCHITECTURAL
Paradoxical boolean rule (A AND NOT A)
Rule validator rejects unsatisfiable queries at save time.
#046ROADMAP
ESG 50-pt drop audit backtrace
Every score change carries a contributing-factor diff.
#047PLANNED
Delete alert mid-distribution
Tombstone marker — in-flight notifications carry a recall token.
#048LIVE DEMO
Escalation after 30min L1 silence
Two-tier SLA timer with auto-escalation to Comex.
#049ROADMAP
Crisis end auto-detection
Velocity decay + sentiment normalisation → auto-resolve alert.
#050ROADMAP
Risk matrix with missing data
Bayesian imputation with confidence band.

Block 6 — Search & Indexation

#051ROADMAP
1B docs in <200ms
Inverted index + early-termination ranking.
#052PLANNED
50-synonym query expansion
Synonym graph with pruning to top-k expansions.
#053PLANNED
Relevance vs recency on generic queries
Query-class router picks the right signal blend.
#054ARCHITECTURAL
Highlight in 10k-word text
Snippet-based highlight, not full-document.
#055ARCHITECTURAL
Mapping mismatch
Explicit schema + reject-on-conflict.
#056ROADMAP
Zero-downtime reindex
Blue/green index swap with dual-write.
#057PLANNED
Polygon geo filter (Morocco map)
GeoJSON polygon containment query.
#058PLANNED
Multi-level aggregation
Composite aggregation with caching.
#059ARCHITECTURAL
Deep pagination (page 50k)
Search-after cursor, not offset.
#060ARCHITECTURAL
Legally-blocked term censor
Blocklist applied at query parse time.

Block 7 — Frontend & UX

#061PLANNED
50k-point chart freeze
Downsample + canvas WebGL renderer + virtualisation.
#062PLANNED
Silent WS disconnect
Exponential backoff reconnection with jitter.
#063ARCHITECTURAL
20 clicks on "Generate Report"
Idempotency key + button lockout.
#064ARCHITECTURAL
Theme switch mid-animation
Animation respects prefers-color-scheme + RAF cancel.
#065ARCHITECTURAL
LocalStorage quota exceeded
LRU eviction + try/catch fallback.
#066ARCHITECTURAL
Violent window resize on dashboard
ResizeObserver debounce + responsive reflow.
#067PLANNED
State desync with DB
TanStack Query invalidation keys + optimistic rollback.
#068PLANNED
Full keyboard nav on data matrix
ARIA grid roles + roving tabindex.
#069PLANNED
3G unstable connection
Response compression + skeleton + retry.
#070ARCHITECTURAL
SSR hydration mismatch
Stable IDs + suppressHydrationWarning where needed.

Block 8 — Reporting & Export

#071PLANNED
500-page vector PDF
Streamed React-PDF render, no full DOM materialise.
#072PLANNED
Chromium headless timeout
Page-by-page render + retry on page failure.
#073ARCHITECTURAL
CSV with commas/quotes/newlines
RFC-4180 compliant quoting.
#074PLANNED
Dynamic watermark for traceability
Per-recipient watermark with user ID + timestamp.
#075ROADMAP
LLM hallucinates financial stats
Citation grounding — every number must trace to a source row.
#076PLANNED
Friday cron fail → Saturday resume
Idempotent job with checkpoint resume.
#077ARCHITECTURAL
25MB+ email attachment
Auto-switch to secure signed link.
#078ROADMAP
1TB API export
Streaming NDJSON + cursor pagination.
#079ARCHITECTURAL
Revoke public report link
Signed URL with short TTL + kill-switch.
#080ARCHITECTURAL
Template change mid-render
Snapshot the template version into the job payload.

Block 9 — Infrastructure & Billing

#081PLANNED
API quota exceeded (429 + overage)
Per-tenant bucket + overage billing hook.
#082ROADMAP
Stripe card update fails
Grace period + dunning emails.
#083PLANNED
Enterprise → Basic downgrade
Feature-gate by plan, no data loss.
#084ROADMAP
Redis down — API survives via Postgres
Cache-aside fallback to DB with circuit breaker.
#085ARCHITECTURAL
Breaking API change
URL versioning /v1/ → /v2/ with deprecation window.
#086PLANNED
Duplicate/out-of-order Stripe webhook
Idempotency key on event ID + ordering by created.
#087ROADMAP
DB split-brain
Quorum + fencing tokens.
#088ROADMAP
Pod OOMKilled mid-task
Job checkpoint + node reschedule.
#089ROADMAP
LLM pricing structure change
Abstracted cost ledger per provider.
#090PLANNED
RGPD 3-year anonymisation
Scheduled PII hashing job.

Block 10 — Pure Business Edge Cases

#091ROADMAP
M&A entity merge without breaking history
Entity graph with successor-of edges, history preserved.
#092PLANNED
Verified-influencer 10000x weight
Dynamic authority weighting in reputation score.
#093ARCHITECTURAL
0 mentions for 3 months → flat line
Sparse series renders flat zero, no crash.
#094ARCHITECTURAL
Client asks to block articles about itself
Integrity policy refuses — data is immutable.
#095PLANNED
Sunday 3am bad-buzz velocity detection
Z-score anomaly on rolling velocity, no volume threshold.
#096ROADMAP
Nested multilingual article (FR quoting AR with EN terms)
Per-segment language detection + routed lexicon.
#097LIVE DEMO
CEO homonym (current vs former)
Tenure-window resolution by article date.
#098LIVE DEMO
Article deleted 5min after publish
Immutable legal archive with "Retiré" tag + hash chain.
#099LIVE DEMO
Astroturfing — recent accounts
Account-age + burst velocity + near-dup content heuristics.
#100ROADMAP
Black Swan — all entities spike simultaneously
Auto-calibration: systemic anomaly suppresses per-entity storm alerts.

Resilience is a product feature, not a checklist.

Every case here maps to a real failure mode a Moroccan media-monitoring client will hit. We publish this catalog openly — the same way we publish where our data comes from and how our scoring works — because trust in an intelligence platform is earned by showing the seams, not by hiding them.

Checking…
Initializing…
HARCH|Atelier

AI Reputation Intelligence — Africa & the French-speaking world.

atelier@harchcorp.com·+212 684 440 682
→ harchcorp.com
Navigation
ProductsSolutionsDecision AugmentationPricingRequest demoAbout
Products
Reputation Intelligence PlatformAPI & MCP IntegrationsInsight ReportsAdvanced DashboardsNewsletters & Briefings
Tools
★ Flagship Report 2026Harch 100 RankingRisk TrackerConsoleReport TemplatesInstitutional Audit
Resources
All resourcesFlagship Report 20262026 Media ReportCase studiesMethodologyFAQ
Company
About usCareersPartnersContactTrust CenterResilience MatrixLegal
8 francophone markets covered
FR
France
Paris · Lyon · Marseille
MA
Morocco
Casablanca · Rabat · Marrakech
BE
Belgium
Brussels · Antwerp
CH
Switzerland
Geneva · Lausanne · Zurich
QC
Quebec
Montreal · Quebec City
TN
Tunisia
Tunis · Sfax
LB
Lebanon
Beirut
SN
Senegal
Dakar
Building in Public, since 2026 · Casablanca, Morocco
Harch Atelier is a Harch Corp venture · Bank transfer